To: 


Of: 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Northern Gas & Power Ltd 


Baltic Place East Tower, South Shore Road, Gateshead, NE8 3AE 


The Information Commissioner (“the Commissioner”)! has decided to 
issue Northern Gas & Power Ltd (“Northern Gas”) with a monetary 
penalty under section 55A of the Data Protection Act 1998 (“DPA”). 
The penalty is in relation to a serious contravention of regulation 21 of 
the Privacy and Electronic Communications (EC Directive) Regulations 
2003 (“PECR’”). 


This notice explains the Commissioner’s decision. 


Legal framework 


Northern Gas, whose registered office is given above (Companies 
House Registration Number: 08430003) is the organisation stated in 
this notice to have used a public electronic communications service for 
the purpose of making unsolicited calls for the purposes of direct 
marketing contrary to regulation 21 of PECR. 


Regulation 21 applies to the making of unsolicited calls for direct 
marketing purposes. It means that if a company wants to make calls 
promoting a product or service to a subscriber who has a telephone 
number which is registered with the Telephone Preference Service 
(“TPS”) or Corporate Telephone Preference Service (“CTPS”), then 
that subscriber must have given their consent to that company to 
receive such calls. 


1 References to “the Commissioner” in this notice include the Commissioner’s Office and 
individuals therein (as applicable). 
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5. Regulation 21(1) of PECR provides that: 


“(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 
unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 
be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 
line is one listed in the register kept under regulation 26.” 


6. Regulations 21(2)-(5) of PECR provide that: 


"(2) A subscriber shall not permit his line to be used in contravention 
of paragraphs (A1) or (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 
made. 


(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under regulation 26 has notified 
a caller that he does not, for the time being, object to such calls 
being made on that line by that caller, such calls may be made by 
that caller on that line, notwithstanding that the number allocated 
to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 
paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at 
any time, and 

(b) where such notification is withdrawn, the caller shall not 
make such calls on that line.” 


7. Under Regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 
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that they do not wish, for the time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The TPS is a limited company 
which operates the register on the Commissioner’s behalf. Businesses 
who wish to carry out direct marketing by telephone can subscribe to 


the TPS for a fee and receive from them monthly a list of numbers on 
that register. 


Section 122(5) of the Data Protection Act 2018 (“DPA 2018") defines 
direct marketing as “the communication (by whatever means) of any 
advertising or marketing material which is directed to particular 
individuals”. This definition also applies for the purposes of PECR (see 
regulation 2(2) PECR and Schedule 19 paragraphs 430 and 432(6) DPA 
2018). 


Prior to 29 March 2019, the European Directive 95/46/EC defined 
‘consent’ as “any freely given specific and informed indication of his 
wishes by which the data subject signifies his agreement to personal 
data relating to him being processed”. 


“Individual” is defined in regulation 2(1) of PECR as “a /iving individual 
and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 
communications services for the supply of such services”. 


Section 55A DPA (as applied to PECR cases by Schedule 1 of PECR, as 
variously amended) states: 


“1) The Commissioner may serve a person with a monetary penalty if 
the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 
Directive) Regulations 2003 by the person, 


(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 


(3) This subsection applies if the person - 
(a) knew or ought to have known that there was a risk that 
the contravention would occur, but 
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(b) failed to take reasonable steps to prevent the 
contravention. 


The Commissioner has issued statutory guidance under section 55C(1) 
of the DPA about the issuing of monetary penalties that has been 
published on the Commissioner’s website. Further to Schedule 1 of 
PECR (as variously amended), Regulation 2 of the Data Protection 
(Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 
prescribed that the amount of any penalty determined by the 
Commissioner must not exceed £500,000. 


The PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. The PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret the PECR in a way which is consistent with their overall aim of 
ensuring high levels of protection for individuals’ privacy rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA 2018: see paragraph 58(1) 
of Schedule 20 DPA 2018. 


Background to the case 


Northern Gas was incorporated on 5 March 2013. Northern Gas is a 
subsidiary of the Global Procurement Group Limited. Northern Gas 
principally brokers commercial energy contracts between commercial 
energy users and various energy providers. 


Northern Gas first came to the attention of the Commissioner in 
respect of the contravention of regulation 21 of PECR during the 
Commissioner’s wider investigation into scams and exploitative 
marketing surrounding the COVID-19 pandemic. The Commissioner 
identified a complaint from the owner of a caravan park who alleged 
that she had received an unsolicited direct marketing call to her 
business landline number from Northern Gas on 21 April 2020, despite 
that number having been registered with the TPS since 4 November 
2006. 
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a. The complainant reported the following regarding the caller: 

“Gave me to understand first he was from Northern PowerGrid 

asking about half hour meters. Here to help us given Covid 

19. That made me suspicious and I asked him again what the 

company was and he said Northern Gas & Power. I asked for 

the number and he gave me 0191-4789579 (his, HED and 

company 0845-6435432. I told him that I had asked Northern 

Gas and Power many times never to call us again. He said 

that they did not have a list of numbers not to call. When I 

asked, he said that they had heard of TPS and GDPR. I asked 

why they were calling us given TPS and GDPR and he said it 

was 'to help us’. He said that he would speak to IT about 

blocking our number.” 


b. The complainant further explained that the call made her 
annoyed and/or anxious, for the following reasons: “I have 
spoken to this company many many times asking them never 
to call us again. «We get so many of these 
calls that they make me really angry and I am likely to have a 
non-positive response to a real potential customer. They are 
also spuriously saying that given Covid 19. they are here to 
help us.” 


Searches of the TPS complaints spreadsheets revealed that between 1 
May 2019 and 30 April 2020 the TPS had received 103 complaints 
about unsolicited direct marketing calls from Northern Gas. 14 of these 
complaints were from subscribers whose telephone numbers were 
registered with the TPS, while 89 complaints were from subscribers 
whose telephone numbers were registered with the Corporate 
Telephone Preference Service (“CTPS”). The spreadsheets also showed 
that the TPS had written to Northern Gas on at least 84 occasions and 
that the company had responded on at least 24 occasions, stating that 
it used Creditsafe for list screening. 


Searches of the complaints received via the Commissioner's online 
reporting tool revealed a total of 62 complaints about Northern Gas 
over the same period. 44 of the complaints were from subscribers 
whose telephone numbers had been registered with the TPS or CTPS 
for more than 28 days. 29 of the complainants said that the calls 
made them annoyed and/or anxious. Complainants reported receiving 
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repeated calls despite opt-out requests and complaints to the 


Commissioner and TPS. They also complained of rude and aggressive 
callers who claimed that the rules did not apply to them. 


The following are examples of some of the comments made by 
complainants, illustrating Northern Gas’ apparent contravention of 
regulations 21(1)(a) and (b) of PECR (as to which see further below): 


a. “I asked if he had been given permission to contact this 
company, and he advised me that is was his right to cold call 
whoever he wanted.” 


b. “The person called to be connected with the person in charge 
of utilities payments. Our company does not deal with utilities 
payments in our building and after the 5th occasion telling 
them this I now have to make a complaint. Our single line 
needs to remain free for the service we provide our clients.” 


c. “A chap called saying he has been in regular contact with us 
and was told to call back in August about our Gas & 
Electricity. I informed him that we have previously asked a 
number of times to be taken off their database after calls that 
we considered harassing. In fact, we have reported them to 
the ICO on a previous occasion.” 


d. “We have told this company several times before not to call us 
and remove us from their database, they are a nuisance. We 
even had an email from them confirming that they would stop 
calling us but it continues. They just ignore our request and 
keep calling us.” 


e. “This company constantly ring us about energy, sometimes 
twice a day from various numbers. We tell them we're not 
interested and ask them politely to remove our data in 
accordance with the GDPR Regulations but they continue to 
call. This has been going on for months now!” 


f. “Caller (BBD has previously been told that we are not allowed 
to put him through to speak to our Directors regarding our 
energy supply last night, despite his forceful attempt to 
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persuade us that he would be allowed to! Rang back again this 
afternoon and was told again but still insisted that he be put 
through. Our female employee who took the call was made 
nervous/anxious by his forceful (could be described as 


aggressive) nature so she had to just hang up as he will not 
take no for an answer” 


. "Telesales dept phoning me on my private mobile number 
trying to sell me energy supply for the company I work for. I 
have taken literally dozen [sic] of calls from this company, 
each time I ask them to remove myself and my company from 
the call list, this never happens. It's now getting stressful.” 


. "Call our business on average 10-20 times a week. Twice so 
far today. Have repeated asked them to remove the number 
and have even spoken to management on the phone who say 
this has been done and it continues. PLEASE can something be 
done about this!” 


“He wanted to know who in the company is responsible for the 
energy supplier. I replied that this number is on the TPS and 
he shouldn't be calling us. He said while I have you on the 
phone can you tell me who is responsible for the energy 
supplier. I started to repeat that we are on the TPS and to ask 
him to remove the number from his call list, but he hung up.” 


“We receive maybe 3 or 4 calls a day from NGP, every day. 
We repeatedly tell them that we're not interested, but they 
never stop and then get rude when you won't direct their call 
to the person in charge of the energy.” 


. “Asking about our energy contracts. I told them we are not 
talking calls as we are in a contract and then they asked for 
more details which was not given. I asked to be removed from 
any list they had and to stop calling to which they replied that 
they did not have a list. I said not to call again and GDPR 
regulations means you need our permission to call. To which 
they just laughed and said it does not apply. Call was then 
terminated. This company calls every couple of weeks.” 
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"Very chummy voice ' asking about our electricity and 

gas supply. I asked him if he had hears [sic] of TPS or GDPR. 

He said he had, but that we were on Google and so that gave 

him the right to contact us. I said that it didn’t and that we 

were on TPS and they shouldn't be cold calling us. I started 

asking for details about the company and he hung up. We 

have started to get a rash of these calls in the last couple of 

days.” 


. "constant cold calls and emails from this company despite 


telling them numerous times we have no desire to do business 
with them, calls from withheld numbers, landline numbers, 
mobile numbers as well as emails from them. We have politely 
asked for them to remove our details from their contact 
database however they are still ringing at least once a day, 
this is becoming harassment as many of the staff who call us 
are rude and borderline abusive when we tell them that we 
are not interested.” 


. "Offering an energy consultancy service. I told them we were 


signed up to CTPS she said she was not selling anything. I 
said it applies to sales and marketing and that I had asked to 
be removed from their database on previous occasions.” 


. “They were asking us the change our electricity and gas 


supplier. They called today, last week and the week before. 
They call me every month. I tell them that I am not interested 
and the lady today said that the only way we would stop 
receiving the calls would be to take up their service. I 
explained that we were registered with TPS and the manager 
Sven said as we have a website with our number on we got it 
from there. Sven said he would remove the details but I have 
asked for this several times.” 


. "wanted to talk to us regarding out suppliers told them we 


were part of TPS they said that didn’t matter as they got our 
number off google - I explained that number is for sales to 
come into the business not unsolicited called. quite rude.” 


21. 


22. 
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q. “Calling to switch our gas and electricity. I advised I was 
registered with the tps and she said 'if I checked every 
number with the tps I wouldn't be able to make any calls” 
On 11 May 2020, an initial investigation letter was sent to Northern 
Gas informing them of the complaints received by the Commissioner 
and the TPS. The letter outlined the requirements of PECR and the 
enforcement powers available to the Commissioner. Northern Gas was 
requested to answer a number of questions by 1 June 2020. 


Following two short extensions, Northern Gas provided a substantive 
response on 11 June 2020. In particular, the letter of 11 June 2020 
included the following: 


a. Northern Gas described its history and growth. 
b. The letter provided: 


“Our management team is always implementing and 
upgrading systems to cope with this rapid growth. To that 
end, we have now developed a formal business management 
structure, a large and growing human resources department 
and, within the last year, a legal department to advise us 
about how best to achieve regulatory and legal compliance 
with all matters that affect our business activities. 


Even prior to your communication, and in the spirit of our 
continued development, we had begun to investigate, 
understand and react to the PECR and its requirements. Whilst 
our review is as yet unfinished, we have made rapid and 
significant progress and we very much look forward to 
concluding our work with your kind support and guidance.” 


c. Northern Gas explained that it did not use call scripts: 


“The nature of our business model (and the services that we 
attempt to sell) means that we do not adopt any particular call 
scripts. Essentially, on any individual call, the intention is to 
identify who at the potential customer has authority to enter 
into their energy supply contracts, to make contact with that 
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individual, to explain what products we offer and to secure 


their authority to look at their options for their next energy 
supply contract(s).” 


. Northern Gas explained that between 1 May 2019 and 30 April 
2020 its two UK offices (in Gateshead and Leeds) had made a 
total of 4,327,858 calls, of which 4,246,990 calls connected. 
The vast majority of calls were made from the Gateshead 
office. 


. To the Commissioner’s request to provide the source of the 
data used to promote Northern Gas’ business, Northern Gas 
stated: 


“Our business model, by its very nature, is intended to be 
extremely flexible to support the differing needs of our various 
customers and potential customers. Whilst the list cannot be 
absolutely prescriptive, we can confirm that our sources 
primarily comprise: 


o Data obtained directly from customers - this is our primary 
source of business in that we aim to create long-term 
relationships with our customers, brokering their successive 
energy contracts for years to come, whilst also providing 
energy consumption management tools, advice and reports to 
help them improve their energy consumption patterns; 


o Google (and other search engine) searches - this is a 
method by which we attempt to identify potential new 
customers. Our account managers will research an industry 
sector, a geographic location or any other means that might 
help them to discover a commercial entity that might be 
interested in our services; 


o Business directories and lists - here we acquire contact lists 
from organisations that maintain those lists. We understand 
those lists to have been properly screened and the commercial 
entities upon them to have consented to their inclusion upon 
such lists. Hence, they have consented to our contact; and 


10 


Information Commissioner's Office 


o Sourced from Creditsafe - a specific method of the above 
category.” 


Northern Gas distinguished between its process for obtaining 
consent when information was obtained directly from 
customers and its reliance on third party vendors as follows: 


“Z If information is obtained directly from customers, how do 
you ensure that they have consented to receiving marketing 
calls. 


Our customers sign a letter of authority, without which we 
cannot approach the energy providers and we cannot provide 
our services to them. As part of that process, their authority 
lasts for a specified time and it must be maintained and 
renewed in order to ensure that they continue to instruct and 
authorise us. Hence, when it comes time to broker a renewal 
of their energy supply contract(s), we either have their 
continued letter of authority to act for them, or we must (and 
do) cease. 


[7 If information is purchased from third parties, what 
contractual obligation do you rely on in relation to the use of 
that information and do you carry out any due diligence 
checks in relation to the list providers to establish whether the 
product is as described (e.g. opt-in data where the subscriber 
has consented to third party use). 


The data that is bought by us is acquired specifically as 
telephone marketing data. As such, it is required to have 
been fully screened and to feature only those businesses that 
have properly consented to their inclusion upon the list and 
for the purposes of receiving contact by our business (or 
others like us).” 


. As to screening data against the TPS and CTPS registers prior 


to making unsolicited marketing calls and the operation of 
suppression lists, Northern Gas stated: 
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“o The primary calls are made to existing customers (for 

whom we have their up to date letter of authority) and to 

commercially acquired lists (which have been screened prior 

to inclusion upon that list). 

o We already have measures in place to remove / block any 

numbers listed on the TPS from our CRM system, whenever 

that is flagged. This includes customers who are not on either 

list but which simply identify to us that they 

do not wish to hear from us with an offer of our services. 

o We ask our sales teams to ensure that the remaining 

numbers not of existing customers or sourced from 

commercial lists (as discussed above) are routinely and 

specifically checked against the TPS or CTPS as appropriate. 


We do have an internal suppression list, which comprises 
every single number that falls into this category. 


We do rely on our sources, such as suppliers and Creditsafe, 
to screen their marketing lists against the TPS and CTPS. For 
our brokers who use Google to source their customers, they 
have been provided with the relevant information regarding 
the TPS and their responsibilities under it. Therefore, the onus 
is currently on them to make sure they are screening every 
number against the TPS and CTPS. However, we are always 
looking to improve this process and our IT team are currently 
working on a system to automate this process.” 


. As to the number of complaints received by the Commissioner 
and the TPS, Northern Gas stated: 


“We conduct up to half a million calls per month; the number 
of complaints appears to be relatively low in comparison. That 
said, our intention is to achieve zero complaints and we are 
rapidly reviewing and improving our systems so as to achieve 
that objective; a process that started before your first 
communication with us. 
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It appears that our systems have allowed a small number of 
errors to be made, but those systems are being interrogated, 
improved and tested as we speak. We have every confidence 
that this is an historic issue and one that we shall entirely 
address with our current efforts.” 


i. Northern Gas described a then recent update to its 
procedures: 


“We have updated our Customer Relationship Management 
system with a “Mark as TPS” button, should any of our 
intended calls happen to be TPS / CTPS registered. This 
instantly flags that fact, allowing our employees to avoid 
contact with such companies by stint of such registered 
number(s)” 


23. Northern Gas additionally provided copies of its calling notice and 
training documents. All employees were required to sign the calling 
notice, which stated: 


“All employees must ensure they comply with the Privacy and 
Electronic Communications Regulation, the Telephone Preference 
Service (TPS) and the Corporate TPS (CTPS) when it comes to 
calling potential customers and/or businesses. 


The TPS is a central register of individuals who have opted out of 
receiving live marketing calls. The CTPS works in the same way 
as the TPS, but for companies and other corporate bodies. You 
must screen all numbers against the TPS and the CTPS before 
commencing any call. 


To screen your numbers, please visit 
https://www.tpsonline.org.uk/register/am_i_registered[?] 


2 The link in the notice directs employees to the ‘Am I registered?’ page on the TPS website. 
This is a search tool designed for individuals to confirm their own TPS registration status. 
There is a daily limit on the number of searches that can be carried out using this tool. The 
search tool is not regarded as a substitute for a valid TPS licence. 
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You may contact someone who is listed on either the TPS or the 
CTPS if they have provided consent for you to contact them. 


Further, we have a suppression list of companies who have 
requested that they are removed from our systems and do not 
wish to receive any calls. You should not be making calls to any 
numbers on this list and should screen all numbers against this 
list before you commence any call. 


All calls are monitored and if you are making unsolicited calls to 
numbers listed on our internal suppression list, the TPS or CTPS 
you may be subject to disciplinary action.” 


24. On 23 June 2020, the Commissioner emailed Northern Gas stating: 


“I understand that Northern Gas and Power relies on its 
employees and data suppliers to ensure that its telephone 
marketing lists are screened against the TPS and CTPS. 


You should be aware that it is the ‘instigator’ of the calls (ie the 
organisation whose products or services are being promoted) 
who is responsible for compliance with regulation 21 of PECR. 
Even if someone else actually makes the calls or supplies the 
marketing list, you are still responsible, as you are ‘instigating’ 
those calls. 


The ICO has published detailed guidance on PECR. This can be 
found on our website (www.ico.org.uk) by following the links ‘For 
Organisations’ and ‘Electronic communications and marketing’. 


In order to determine the scale of the contravention and whether 
Northern Gas and Power took reasonable steps to prevent it, I 
would be grateful if you would provide me with the following 
information: 

* call detail records showing all connected outbound calls made 
by the company between 1 May 2019 and 30 April 2020, 
including the number called, date and time of the call and call 
duration; 

* copies of contracts and/or invoices from your data suppliers 
showing that the data was purchased as TPS screened; 
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* details of any due diligence checks carried out on the data 
suppliers or the data; 
* evidence that the complainants had consented to calls from 
Northern Gas and Power; 
* confirmation as to whether or not the company holds a TPS 
licence; 
* details of any remedial actions taken in response to complaints 


received by the TPS and ICO. 


I would be grateful if you could provide this information within 14 
days of the date of this email. If you have any questions, please 
do not hesitate to contact me.” 


25. Northern Gas responded on 15 July 2020. 


a. Northern Gas explained that it historically relied upon 
warranties from their third party data suppliers that lists were 
fully screened against the CTPS / TPS. Northern Gas provided 
a link to the frequently asked questions section on Creditsafe's 
website which contained the following question and answer: 


“Q: “Does the TPS Flag include CTPS registered telephone 
numbers, as well as TPS?” 

A: "Yes. The TPS flag shown on the Creditsafe website covers 
both TPS and CTPS registered telephone numbers. Therefore 
any telephone number that has a TPS flag as YES is either 
TPS, CTPS registered or both.”” 


b. Northern Gas maintained that the statement on Creditsafe’s 
website formed part of the legal terms of the contractual 
arrangements between Northern Gas and Creditsafe. 
Northern Gas, however, failed to provide a copy of the actual 
contract or any other due diligence checks which it had 
undertaken. 


c. Northern Gas clarified that had now purchased its own TPS 


licence such that it was no longer reliant on warranties from 
third party data suppliers. 
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d. Northern Gas stated the following with regard to evidence of 
complainant’s consent to calls: 


“We have previously submitted our records that a few of those 
numbers (fewer than ten) in fact had active Letters of 
Authority by which we were instructed to provide their energy 
brokering services. This included contacting those customers 
again in an attempt to broker their energy supply contracts for 
their next energy supply period. 


For the remainder, whilst some of those numbers appeared 
more than once within the data, the fact is these numbers 
were called and we have no further proof that they gave us 
any specific exemption from their registration at the CTPS / 
TPS.” 


e. As to the remedial actions taken by Northern Gas in response 
to the complaints received by the Commissioner and the TPS, 
Northern Gas stated: 


“We have been extremely proactive both to identify and 
understand the issue and to ensure that we have taken any 
and all steps to remedy the issue. 

We discuss above our method of checking against the CTPS / 
TPS. 


We now have a state of the art system for blocking all TPS 
registered numbers as well as any simply requested to be 
blocked by the end party without any CTPS / TPS formality. 
Given the technological advances that we have made to 
enforce the CTPS / TPS lists we expect to be able to eliminate 
any non-customer calls made to a CTPS / TPS registered 
number.” 


26. Northern Gas additionally provided a link to a dropbox containing call 
detail records. These consisted of 51 separate spreadsheets covering 
various date ranges. As to the spreadsheets: 


a. The calls from Northern Gas’ Leeds office were split across two 
spreadsheets: one covering the period 1 March 2019 to 30 
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September 2019 and the other covering the period 1 October 


2019 to 30 April 2020. These two spreadsheets listed a total 
of 340,768 calls. 


b. The two spreadsheets were sent to the TPS for screening, 
which revealed that 60,641 of the 340,768 calls were to 
numbers that had been registered with the TPS or CTPS for 
more than 28 days. 


a. Further analysis of the remaining spreadsheets revealed that 
they included both marketing and non-marketing calls, calls 
from company directors, overseas calls, calls to freephone 
numbers, internal calls, and unanswered calls. However, they 
did not include some of the marketing calls that were the 
subject of complaints to the Commissioner and the TPS. 


On 24 August 2020, amongst other things, the Commissioner 
requested Northern Gas to confirm how many of the 4,246,990 
connected calls made between 1 May 2019 and 30 April 2020 were 
direct marketing calls and to provide call detail records for those calls. 


On 27 October 2020, Northern Gas responded to the Commissioner’s 
email. 


a. Northern Gas stated in the covering email: “The headlines are 
that we have essentially eliminated any breaches of the CTPS 
and are working with the manufacturer of our software in 
order to further develop a market leading programme that will 
benefit not only us but many other businesses like us. That 
programme identifies all CTPS numbers and physically 
prevents them from being called from our telephone systems. 
Only where we obtain the customer’s express permission can 
we then override the CTPS block.” 


b. However, Northern Gas did not provide the requested 
information. Instead, Northern Gas provided a report entitled 
“NGP CTPS Call Statistics for ICO” (“the NGP Report”) which 
included the following table of “CTPS Call Statistics” showing 
call statistics for the period March 2020 to September 2020. 
The data was extracted directly from the ff phone system 
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database as primary source. That data was matched with the 


CTPS dataset and filtered to exclude multiple calls to the same 
number, calls of less than 3 seconds or longer than 60 


seconds and calls to numbers listed in their CRM system. 


Month Total Calls CTPS Calls % CTPS (from 
(3.4M total) (Filters Applied) | Total Calls) 

March 2020 39,748 318 0.800% 
April 2020 274,030 1,211 0.442% 
May 2020 345,243 1,566 0.454% 
June 2020 593,399 2,272 0.383% 
July 2020 804,380 1,424 0.177% 
August 2020 646,388 16 0.002% 
September 741,552 15 0.002% 
2020 

c. The NGP Report explained that in March 2020, Northern Gas 


moved away from a local Avaya phone system that was 
limited to the office network to a more modern and flexible 
system based on the [J phone system. This was a necessary 
reaction to the sudden COVID-19 pandemic which had 
enabled its workforce to work from home in an effective, 
secure, and controlled Voice over Internet Protocol e D 
telephony system. The previous Avaya phone system provided 
a native outgoing call blocking feature which was used to 
block numbers effectively. Northern Gas had planned to use 
the ii outgoing rules to block CTPS calls automatically; 
however this feature did not work well and had performance 
impacts on its operations. Only critical numbers were blocked 
in limited amounts due to outgoing rules limitations. 


. Northern Gas nevertheless took a number of steps to ensure 


that CTPS calls were not made using the system. Those 
steps included but were not limited to: the staff induction 
programme, the training materials and programmes, and the 
tool-box talks and management efforts. At the same time, 
Northern Gas put its effort into researching third party 
solutions that would offer the flexibility to use the CTPS 
database and allow for further custom blocked numbers for 
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exclusive sales reasons while not affecting system 
performance. 


e. In August 2020 the MM «Do Not Call (“DNC”) third party 
product was selected and deployed to the live = phone 
system following several days of testing. After using this tool 
for some weeks, Northern Gas identified improvements in its 
usage and block handling. Northern Gas contacted the EE 
development team who were very positive and open to 
implement these enhancements for the benefit of all users of 
the product. 


f. The NGP Report concluded that the introduction of the E 
addon had been very effective in controlling CTPS 
calls. It acknowledged that there was still room for 
improvement and outlined some of the issues Northern Gas 
was working on in order to eliminate CTPS calls completely. 


The Commissioner reviewed the NGP Report, concluding that it did not 
accurately reflect the number of contraventions of the PECR. The 
spreadsheets concerning Commissioner and TPS complaints were 
interrogated further, revealing that between August 2020 and 
November 2020 there had been at least 59 complaints about 
unsolicited direct marketing calls from Northern Gas. Those complaints 
suggested that Northern Gas was continuing to make unsolicited direct 
marketing calls in contravention of regulations 21(1)(a) and (b) of 
PECR. 


Accordingly, on 9 December 2020, the Commissioner emailed Northern 
Gas. 


a. The Commissioner set out her concerns as to the accuracy of 
the NGP Report. 


b. The Commissioner requested Northern Gas to provide 
unfiltered call detail records showing all 3,444,740 calls made 
by Northern Gas between March 2020 and September 2020. 


c. The Commissioner explained that searches of the 
Commissioner and TPS complaints databases revealed that, 
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between August and November 2020, the Commissioner and 
TPS received at least 59 complaints about unsolicited direct 
marketing calls from Northern Gas, including 40 complaints 
from businesses whose telephone numbers were registered 
with the TPS or CTPS. Many of these complaints were from 
businesses who had previously notified Northern Gas that they 
did not wish to receive such calls. 


d. The Commissioner also reminded Northern Gas of her 
enforcement powers. 


On 10 February 2021, Northern Gas responded. Northern Gas 
requested further details of “the August to November 2020 complaints 
(suggested to be 40 CTPS/TPS complaints and 19 non-CTPS/TPS 
requests not to be called).” Northern Gas further stated: 


“Z7 Our records show that we did not call CTPS / TPS registered 
numbers from our system, so if there are calls being made on our 
behalf, they would logically not be from our system. We would thus 
like details to check if our system is failing or if it is being 
circumvented, etc. 


LI Equally, for those not registered but asking us not to call, we 
would wish to research if / why / how the request not to be called 
is being expressed but not being actioned; when our method to 
block numbers is so simple and is so stringently enforced.” 


On 11 February 2021, the Commissioner sent Northern Gas a 
spreadsheet containing details of complaints received by the 
Commissioner and TPS between 1 August 2020 and 31 January 2021. 
76 complaints were received in that period. The Commissioner noted: 
“All of the calls listed in the spreadsheet appear to have been made in 
contravention of regulation 21(1)(a) and/or regulation 21(1)(b) of 
PECR.” 


On 17 March 2021, Northern Gas responded to the Commissioner’s 
email as follows: 
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“Thank you for your continued patience whilst we addressed 


these further matters that you brought to our attention in your 
email below. 


When you first contacted us, it allowed us to study and report 
upon our calls data from March to September 2020. 


Our previous efforts ensured that we now automatically block all 
TPS / CTPS registered numbers and that they cannot be called 
from our telephone system. We then added additional (and 
simplified) methods to ensure that any customer who asks not to 
be called by us can easily be blocked; supported by training for 
our staff to ensure these new methods are adopted. 


In your email, however, you noted that between August and 
November 2020, the ICO and TPS received at least 59 complaints 
about unsolicited direct marketing calls from NGP. 


Whilst this of course overlapped with our own study (August and 
September 2020) and so repeated data already addressed by our 
remedies, you observed that our extensive improvements made 
to date still allowed a few exceptions to occur. We have studied 
all of the further complaints and can report three further 
improvement s that have now been made. 


* The first category we call “block evasion”, where the TPS / 
CTPS registered number is successfully blocked on our system, 
but it appears the block could be avoided by using an 
international dial code. Hence our system blocked 0191 numbers 
but not 0044 191 numbers. This issue has been fixed by our 
paying (BM to add a country code blocking feature to all 
TPS / CTPS registered numbers for us. This block evasion issue 
has now been resolved. 

* The second category we call “residential TPS”, where we 
initially focussed upon blocking the CTPS registered numbers 
(since our purpose is to contact commercial entities and not 
domestic energy customers). We then realised that a tiny 
fraction of those commercial entities we contacted would be sole 
traders and partnerships, such that they could potentially use 
their domestic number as a business number. We have now 
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imported and blocked the entire TPS in additional to the CTPS. 

This residential TPS issue has now been resolved. 

* The third category we call “not blocked / custom blocking”, 

where customers who are not TPS / CTPS registered specifically 

ask us not to contact them. Although we introduced the above 

methods to ensure that any customer who asks not to be called 

by us can easily be blocked; supported by training for our staff, 

we have improved our blocking flows methods and these are now 

typically blocked in under two hours from request. We have 

further plans to improve the not blocked / custom blocking 

methods by developing an internal system that sales managers 

would be able to use themselves. We are confident that the not 

blocked / custom blocking issue has now been resolved, but we 

continue to develop even more user-friendly solutions to this 

remaining issue. 


As it stands, NGP believes that all these elements can be 
considered as resolved, which together cover all of the numbers / 
issues in the further 59 complaints sent to us by the ICO. 


Whilst we are convinced that these further measures shall now 
be entirely effective, if any further issues come to light or if you 
think we can do anything more to ensure our future compliance, 
we would be pleased to receive your support and guidance.” 


On 23 March 2021, the Commissioner emailed Northern Gas to confirm 
that he had completed her enquiries and would go on to consider 
whether formal enforcement action was appropriate. Northern Gas was 
invited to submit, by 30 March 2021, “any relevant evidence, or 
information regarding your policies, procedures and training 
programmes, and which you have not yet supplied to this office”. 


On 24 March 2021, Northern Gas provided further information in 
respect of the third category identified in its email of 17 March 2021, 
stating: 


“I write to relay the fact that we have now developed an internal 
system that sales managers would be able to use themselves and 
the poster copied below details the further steps that we have 
taken. That poster has been circulated nationally by email and the 
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new method has been a feature of our recent training to all of 
sales. You will notice that it is now as simple as pressing a button 


and that we have emphasised it is a disciplinary offence to fail to 
do so when asked to.” 


The poster in question stated: “Jf anyone requests their number to be 
blocked from the system you MUST use the BLOCK button in 360 or 
send an email to IT with the telephone number and the reason to 
block to ensure it is blocked system-wide. Failure to follow the 
above could lead to disciplinary action.” [Emphasis original] 


Further searches of the Commissioner and TPS’ complaints 
spreadsheets, conducted on 6 April 2021, revealed that between 1 
February and 30 March a further 32 complaints were received about 
unsolicited direct marketing calls from Northern Gas. The complaints 
included calls to both TPS and CTPS registered numbers, as well as to 
subscribers who had specifically notified Northern Gas that they did not 
wish to receive such calls. For example, a subscriber, whose telephone 
number had been registered with the TPS since 2005, complained as 
follows: 


“They are a [sic] energy supplier or broker, and when I said we 
do not want their service they hang up and call again the next 
day. When I have asked to be removed from their call list they 
hang up and call again the next day. We are small but very busy 
care home, and do not wish to spend time with these calls 
especially considering these busy COVID times for us.” 


An additional complaint was received in February 2021. The 
complainant reported that it continued to receive over five marketing 
calls per day from Northern Gas, despite having notified Northern Gas 
by email in May 2020 and January 2021 that it did not wish to receive 
such calls and requesting the removal of its details from Northern Gas’ 
system. Those emails had been sent to the directors of Northern Gas. 


The Commissioner is satisfied that the calls made by Northern Gas and 


which were subject to complaints to the TPS/CTPS were all made for 
the purposes of direct marketing as defined by section 122(5) DPA18. 
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The Commissioner has made the above findings of fact on the 
balance of probabilities. 


The contravention 


The Commissioner has considered whether those facts constitute a 
contravention of regulation 21 of PECR by Northern Gas and, if so, 
whether the conditions of section 55A DPA are satisfied. 


The Commissioner finds that Northern Gas contravened regulation 21 
of PECR. The Commissioner finds that the contravention was as 
follows: 


Between 1 May 2019 and 31 March 2021, Northern Gas used a public 
telecommunications service for the purposes of making unsolicited calls 
for direct marketing purposes to subscribers where the number 
allocated to the subscriber in respect of the called line was a number 
listed on the register of numbers kept by the Commissioner in 
accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. 
This resulted in 337 complaints being made to the TPS and the 
Commissioner in respect of Northern Gas. 


Additionally, as set out above, during the same period Northern Gas 
used a public telecommunications service for the purposes of making 
unsolicited calls for direct marketing purposes to subscribers where the 
called line was that of a subscriber who had previously notified the 
caller that, for the time being, such calls should not be made on that 
line, contrary to regulation 21(1)(a) of PECR. 


The Commissioner is also satisfied for the purposes of regulation 21 
that these unsolicited direct marketing calls were made to subscribers 
who had registered with the TPS at least 28 days prior to receiving the 
calls, and who for the purposes of regulation 21(4) had not notified 
Northern Gas that they did not object to receiving such calls 


For such notification to be valid under regulation 21(4), the individual 
must have taken a clear and positive action to override their TPS 
registration and indicate their willingness to receive marketing calls 
from the company. The notification should reflect the individual’s 
choice about whether or not they are willing to receive marketing calls. 
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Therefore, where signing up to use a product or service is conditional 
upon receiving marketing calls, companies will need to demonstrate 


how this constitutes a clear and positive notification of the individual’s 
willingness to receive such calls. 


The notification must clearly indicate the individual’s willingness to 
receive marketing calls specifically. Companies cannot rely on 
individuals opting in to marketing communications generally, unless it 
is clear that this will include telephone calls. 


Further, the notification must demonstrate the individual's willingness 
to receive marketing calls from that company specifically. Notifications 
will not be valid for the purposes of regulation 21(4) if individuals are 

asked to agree to receive marketing calls from “similar organisations”, 


"n 


“partners”, “selected third parties” or other similar generic descriptions. 


Northern Gas has been unable to demonstrate that the TPS subscribers 
called had given such prior notification in the vast majority of cases. In 
particular, the Commissioner and the TPS received a total of 337 
complaints over a 23 month period, from subscribers whose telephone 
numbers were registered with the TPS or CTPS or who had previously 
notified Northern Gas that they did not wish to receive such calls. 


The Commissioner has gone on to consider whether the conditions 
under section 55A DPA are met. 


Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because there have been multiple breaches 
of regulation 21 by Northern Gas arising from the organisation’s 
activities between 1 May 2019 and 31 March 2021, leading to an 
unknown number of unsolicited direct marketing calls being made to 
subscribers who were registered with the TPS or CTPS and who had not 
provided valid consent. The Commissioner and TPS received a total of 
337 complaints from subscribers whose telephone numbers were 
registered with the TPS or CTPS or who had previously notified 
Northern Gas that they did not wish to receive such calls over the 23 
month period as a result (averaging 15 complaints per month). 
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Based on his experience of like incidents of unsolicited direct marketing 

calls, the Commissioner is of the view that the number of complaints is 

likely to represent only a small proportion of the actual number of 

breaches. Northern Gas has stated that it made up to half a million 

calls per month. Whilst the Commissioner is unable to confirm 

precisely how many calls were made in breach of PECR, by way of an 

indication of scale of the likely breaches, the Commissioner has 

established that 60,641 of the 340,768 calls made by the Leeds office 

over a 14 month period were made to telephone numbers that were 

registered with the TPS or CTPS, amounting to 18% of the calls made 

by that office. 


The contravention was also serious due to the frequency and content of 
the calls. Complainants reported receiving multiple calls over a short 
period of time, despite repeated opt-out requests and complaints to the 
Commissioner and TPS. They also complained of rude and aggressive 
callers who claimed that the rules did not apply to them. Many of the 
complainants reported that the calls made them annoyed and/or 
anxious. Some of the complainants said they were being called on 
their personal mobiles and this was adding to the stress caused by 
COVID-19. Others said the calls were disrupting their business and 
tying up lines used by customers. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 
above was deliberate. The Commissioner does not consider that 
Northern Gas deliberately set out to contravene the PECR in this 
instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 
elements: 


Firstly, he has considered whether Northern Gas knew or ought 
reasonably to have known that there was a risk that this contravention 
would occur. He is satisfied that this condition is met, as follows. 
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The Commissioner has published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 
This guidance explains the circumstances under which organisations 
are able to carry out marketing over the phone, by text, by email, by 
post or by fax. Specifically, it states that live calls must not be made to 
any subscriber registered with the TPS, unless the subscriber has 
specifically consented to receive calls. The Commissioner has also 
published detailed guidance on consent under the GDPR. In case 
organisations remain unclear on their obligations, the Commissioner 
operates a telephone helpline. The Commissioner’s communications 
about previous enforcement action where businesses have not 
complied with PECR are also readily available. 


Northern Gas has been in existence since 2013 and operates a 
business model which predominately includes direct marketing. As 
such, it should have been aware of the requirements of the PECR. 
Indeed, Northern Gas demonstrated that they knew about the legal 
requirements of the PECR in their instructions to staff to ensure that 
they screened against the TPS. 


The TPS notified Northern Gas of at least 84 complaints that it had 
received over the period of the contravention and this should have 
made Northern Gas aware of the risk that such contraventions may 
occur and were indeed occurring. 


It is therefore reasonable to suppose that Northern Gas should have 
been aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether Northern 
Gas failed to take reasonable steps to prevent the contravention. 
Again, he is satisfied that this condition is met. 


Northern Gas has conceded that it only recently has “begun to 
investigate, understand and react to the PECR and its requirements”. 
Even as late as June 2020, Northern Gas’ review was unfinished. In 
such circumstances, Northern Gas’ compliance with the PECR was far 
too delayed and inadequate. 
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Moreover, Northern Gas relied upon generic assurances from its third 

party data suppliers that its lists were fully screened against the TPS 

and CTPS. Northern Gas did not agree and implement specific 

contractual arrangements, supported by appropriate due diligence 

checks, to ensure compliance with the PECR. The Commissioner’s 

direct marketing guidance makes clear that organisations acquiring or 

utilising marketing lists from a third party must undertake rigorous 

checks to satisfy themselves that the personal data was obtained fairly 

and lawfully, that their details would be passed along for direct 

marketing to the specifically named organisation in the case of live 

calls, and that they have the necessary consent. It is not acceptable to 

rely on assurances given by third party suppliers without undertaking 

proper due diligence. 


In circumstances in which an organisation buys or rents a marketing 
list from a list broker or other third party, the Commissioner’s Direct 
Marketing Guidance at §179 identified that checks of the following 
nature might fall within the scope of reasonable due diligence 
obligations: 


“- Who compiled the list? When? Has it been amended or 
updated since then? 

e When was consent obtained? 

e Who obtained it and in what context? 

e What method was used - eg was it opt-in or opt-out? 

e Was the information provided clear and intelligible? How was it 
provided - eg behind a link, in a footnote, in a pop-up box, ina 
clear statement next to the opt-in box? 

e Did it specifically mention texts, emails or automated calls? 

e Did it list organisations by name, by description, or was the 
consent for disclosure to any third party? 

e Has the list been screened against the TPS or other relevant 
preference services? If so, when? 

e Has the individual expressed any other preferences - eg 
regarding marketing calls or mail? 

e Has the seller received any complaints? 

-Is the seller a member of a professional body or accredited in 
some way?” 
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Northern Gas failed to implement an effective TPS screening system, 
relying instead on a search tool designed for individuals that has a daily 
limit of 3 searches per IP address per day. The Commissioner’s Direct 
Marketing Guidance at §189 identified that: “Organisations should 
generally screen an in-house marketing list against the TPS register 
before making any marketing calls.” The Guidance further provides: 
“Bought-in call lists should be screened against the TPS. It will be very 
difficult to use bought-in lists for text, email, or automated call 
campaigns as these require very specific consent (either where the 
specific organisation is named or it is within a precisely defined 
category of organisation).” §126 of the Guidance clarifies that the 
requirement to screen lists against the TPS applies in respect of 
business-to-business calls: “The same rules apply to marketing calls 
made to businesses. Sole traders and partnerships may register their 
numbers with the TPS in the same way as individual consumers, while 
companies and other corporate bodies register with the Corporate 
Telephone Preference Service (CTPS). So organisations making 
business-to-business marketing calls will need to screen against both 
the TPS and CTPS registers.” 


Northern Gas failed to take appropriate and swift remedial action in 
response to complaints from subscribers and correspondence from the 
Commissioner and TPS. This is evidenced by the fact that complaints 
continued to be received throughout the course of the Commissioner’s 
investigation. 


Given the volume of calls and complaints and the matters identified 
above, it is clear that Northern Gas failed to take appropriate and 
reasonable steps. The Commissioner is therefore satisfied that 
condition (b) of section 55A (1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 


The Commissioner has taken into account the following aggravating 
features of this case: 


a. Reports noted the pressurising and persistent nature of the 
calls in question, including when a cessation of further calls 
had been requested. 
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b. The calls in question caused an unnecessary degree of 
interruption to businesses and their trading activity, in 
particular during the difficult trading conditions of the 
Coronavirus pandemic. 


c. The aim of the calls in question was to generate financial gain 
by way of an increase in profits arising from further business. 


d. Northern Gas only responded to complaints upon the 
commencement of the Commissioner's investigations, rather 
than upon their prior notice of the same. 


The Commissioner has taken into account the following mitigating 
features of this case: 


a. Northern Gas has now confirmed that it has purchased its 
own TPS licence and call screening/blocking software (albeit 
the latter has been subject to technical failures). 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. He is 
also satisfied that the procedural rights under section 55B have been 
complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out his preliminary thinking. In reaching his final 
view, the Commissioner has taken into account the representations 
made by Northern Gas on this matter. 


The Commissioner is accordingly entitled to issue a monetary penalty 
in this case. 


The Commissioner has considered whether, in the circumstances, he 
should exercise his discretion so as to issue a monetary penalty. 


The Commissioner has considered the likely impact of a monetary 
penalty on Northern Gas. He has decided on the information that is 
available to him that Northern Gas has access to sufficient financial 
resources to pay the proposed monetary penalty without causing 
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undue financial hardship and that a penalty remains the appropriate 
course of action in the circumstances of this case. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 
to reinforce the need for businesses to ensure that they are only 
telephoning consumers who are not registered with the TPS and/or 
specifically consent to receive these calls. 


For these reasons, the Commissioner has decided to issue a monetary 
penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £75,000 (75,000 pounds) is reasonable 
and proportionate given the particular facts of the case and the 
underlying objective in imposing the penalty. 


Further and for avoidance of doubt, the Commissioner regarded the 
mitigating factor identified at paragraph 70(a) above as warranting a 
reduction of the penalty from £80,000 to £75,000. 


Conclusion 


The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 18 January 2022 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 


17 January 2022 the Commissioner will reduce the monetary penalty 
by 20% to £60,000 (sixty thousand pounds). However, you should 
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be aware that the early payment discount is not available if you decide 
to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 
against: 


(a) the imposition of the monetary penalty 
and/or; 

(b) the amount of the penalty specified in the monetary penalty 
notice. 


Any notice of appeal should be received by the Tribunal within 28 days 
of the date of this monetary penalty notice. 


Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 
unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 
penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 
variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 
variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 
issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 15th day of December 2021 


Andy Curry 
Head of Investigations 
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SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 


RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. 


Section 55B(5) of the Data Protection Act 1998 gives any person 


upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 
against the notice. 


2. 


If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 
accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that he ought to have exercised 
his discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 
Tribunal will dismiss the appeal. 


3. 


You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 


Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 
a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 
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b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state:- 


a) your name and address/name and address of your 
representative (if any); 


b) an address where documents may be sent or delivered to 
you, 


c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 
monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 
notice of appeal must include a request for an extension of time 
and the reason why the notice of appeal was not provided in 
time. 


Before deciding whether or not to appeal you may wish to consult 


your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 
whom he may appoint for that purpose. 


6. 


The statutory provisions concerning appeals to the First-tier 


Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 


35 


